Oh, I see. That complicates it a wee bit (looks back at your messages).
I see you have:
rgw_keystone_url = http://192.0.8.2:5000
So you'll need to amend/create etc a
<Virtualhost *:5000>
and put it in there. I suspect you might be better off changing your rgw
kesytone url to use port 35357 (the public one). However I think that is
a side issue.
Also just to double check - 192.0.8.2 *is* the server you are showing us
the sites-available from?
Cheers
Mark
On 10/10/14 12:50, lakshmi k s wrote:
Yes Mark, but there is no keystone.conf in this modified Openstack code.
There is only horizon.conf under /etc/apache2/sites-available folder.
And that has virtual host 80 only. Should I simply add :35357?
root@overcloud-controller0-fjvtpqjip2hl
<mailto:root@overcloud-controller0-fjvtpqjip2hl>:/etc/apache2/sites-available#
ls
000-default.conf default-ssl.conf horizon.conf
On Thursday, October 9, 2014 4:45 PM, Mark Kirkwood
<mark.kirkwood@xxxxxxxxxxxxxxx> wrote:
Hmm - It looks to me like you added the chunked request into Horizon
instead of Keystone. You want virtual host *:35357
On 10/10/14 12:32, lakshmi k s wrote:
> Have done this too, but in vain. I made changes to Horizon.conf as shown
> below. I had only I do not see the user being validated in radosgw log
> at all.
>
> root@overcloud-controller0-fjvtpqjip2hl
<mailto:root@overcloud-controller0-fjvtpqjip2hl>:/etc/apache2/sites-available#
ls
> 000-default.conf default-ssl.conf horizon.conf
>
> ----------------------------------------------------
> <VirtualHost *:80>
> WSGIScriptAlias /
>
/opt/stack/venvs/horizon/lib/python2.7/site-packages/openstack_dashboard/wsgi/django.wsgi
> WSGIDaemonProcess horizon user=horizon group=horizon processes=3
> threads=10 home=/opt/stack/venvs/horizon
>
python-path=/opt/stack/venvs/horizon:/opt/stack/venvs/horizon/lib/python2.7/site-packages/
> WSGIApplicationGroup %{GLOBAL}
>
> SetEnv APACHE_RUN_USER horizon
> SetEnv APACHE_RUN_GROUP horizon
> WSGIProcessGroup horizon
> WSGIChunkedRequest On
>
> DocumentRoot
>
/opt/stack/venvs/horizon/lib/python2.7/site-packages/openstack_dashboard/static
> Alias /static
>
/opt/stack/venvs/horizon/lib/python2.7/site-packages/openstack_dashboard/static
> Alias /media
>
/opt/stack/venvs/horizon/lib/python2.7/site-packages/openstack_dashboard/static
>
> <Directory />
> Options FollowSymLinks
> AllowOverride None
> </Directory>
>
> <Directory
>
/opt/stack/venvs/horizon/lib/python2.7/site-packages/openstack_dashboard/static>
> Options Indexes FollowSymLinks MultiViews
> Require all granted
> AllowOverride None
> Order allow,deny
> allow from all
> </Directory>
>
> <Directory
> /opt/stack/venvs/horizon/lib/python2.7/site-packages/openstack_dashboard>
> Options Indexes FollowSymLinks MultiViews
> Require all granted
> AllowOverride None
> Order allow,deny
> allow from all
> </Directory>
>
> ErrorLog /var/log/httpd/horizon_error.log
> LogLevel debug
> CustomLog /var/log/httpd/horizon_access.log combined
> </VirtualHost>
>
> WSGISocketPrefix /var/run/httpd
>
> ----------------------------------
>
>
>
>
> On Thursday, October 9, 2014 3:51 PM, Mark Kirkwood
> <mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>> wrote:
>
>
> No, I don't have any explicit ssl enabled in the rgw site.
>
> Now you might be running into http://tracker.ceph.com/issues/7796
> <http://tracker.ceph.com/issues/7796>. So
> check if you have enabled
>
> WSGIChunkedRequest On
>
> In your keystone virtualhost setup (explained in the issue).
>
> Cheers
>
> Mark
>
>
> On 10/10/14 11:03, lakshmi k s wrote:
> > Right, I have these certs on both nodes - keystone node and rgw
gateway
> > node. Not sure where I am going wrong. And what about SSL? Should the
> > following be in rgw.conf in gateway node? I am not using this as
it was
> > optional.
> >
> > SSLEngine on
> > SSLCertificateFile /etc/apache2/ssl/apache.crt
> > SSLCertificateKeyFile /etc/apache2/ssl/apache.key
> > SetEnv SERVER_PORT_SECURE 443
> >
> >
> >
> >
> >
> > On Thursday, October 9, 2014 2:48 PM, Mark Kirkwood
> > <mark.kirkwood@xxxxxxxxxxxxxxx <mailto:mark.kirkwood@xxxxxxxxxxxxxxx>
> <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>>> wrote:
> >
> >
> > Almost - the converted certs need to be saved on your *rgw* host in
> > nss_db_path (default is /var/ceph/nss but wherever you have it
> > configured should be ok). Then restart the gateway.
> >
> > What is happening is the the rgw needs these certs to speak with
> > encryption to the keystone server (the latter does not need anything
> > changed, as it is already using encryption).
> >
> > Regards
> >
> > Mark
> >
> > On 10/10/14 08:31, lakshmi k s wrote:
> > > Thanks Mark. I got past this error being root. So essentially, I
> copied
> > > the certs from openstack controller node to gateway node. Did the
> > > conversion using certutil and copied the files back to
controller node
> > > under /var/lib/ceph/nss directory. Is this the correct
directory? Ceph
> > > doc says /var/ceph/nss though.
> > >
> > > But after this, I tried to use curl GET command, but in
vain.Same old
> > > 401 - Authorization failure.
> > >
> > > curl -i -X GET
> > >
http://gateway.ex.com/swift/v1/AUTH_bad9e2232b304f89acb03436635b80cc
> >
<http://gateway.ex.com/swift/v1/AUTH_bad9e2232b304f89acb03436635b80cc>-H
> > > "X-Auth-
> > > Token: a510edb22f074946940cd4c07aafcd9d"
> > >
> > > HTTP/1.1 401 Unauthorized
> > > Date: Thu, 09 Oct 2014 19:17:31 GMT
> > > Server: Apache/2.4.7 (Ubuntu)
> > > Accept-Ranges: bytes
> > > Content-Length: 12
> > > Content-Type: text/plain; charset=utf-8
> > > AccessDeniedroot
> > >
> > > Not much difference in radosgw logs too. Note that the token used
> above
> > > is same one in ceph.conf file too. Please help.
> > >
> > > [client.radosgw.gateway]
> > > rgw keystone url = http://192.0.8.2:5000 <http://192.0.8.2:5000/>
> <http://192.0.8.2:5000/><http://192.0.8.2:5000/>
> > > rgw keystone admin token = a510edb22f074946940cd4c07aafcd9d
> > > rgw keystone accepted roles = admim Member _member_ swiftoperator
> > > rgw keystone token cache size = 500
> > > rgw keystone revocation interval = 500
> > > rgw s3 auth use keystone = false
> > > nss db path = /var/lib/ceph/nss
> > > debug rgw = 20
> > > host = gateway
> > > keyring = /etc/ceph/ceph.client.radosgw.keyring
> > > rgw socket path = /var/run/ceph/ceph.radosgw.gateway.fastcgi.sock
> > > log file = /var/log/ceph/client.radosgw.gateway.log
> > > rgw dns name = gateway
> > >
> > >
> > >
> > >
> > >
> > > On Thursday, October 9, 2014 1:15 AM, Mark Kirkwood
> > > <mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>>
> > <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>
> <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>>>> wrote:
> > >
> > >
> > > I ran into this - needed to actually be root via sudo -i or
similar,
> > > *then* it worked. Unhelpful error message is I think referring
to no
> > > intialized db.
> > >
> > > On 09/10/14 16:36, lakshmi k s wrote:
> > > > Good workaround. But it did not work. Not sure what this error
> is all
> > > > about now.
> > > >
> > > > gateway@gateway <mailto:gateway@gateway>
<mailto:gateway@gateway <mailto:gateway@gateway>>
> <mailto:gateway@gateway <mailto:gateway@gateway>
<mailto:gateway@gateway <mailto:gateway@gateway>>>
> <mailto:gateway@gateway <mailto:gateway@gateway>
<mailto:gateway@gateway <mailto:gateway@gateway>>
> > <mailto:gateway@gateway <mailto:gateway@gateway>
<mailto:gateway@gateway <mailto:gateway@gateway>>>>:~$ openssl x509 -in
> > > /home/gateway/ca.pem -pubkey |
> > > > certutil -d /var/lib/ceph/nss -A -n ca -t "TCu,Cu,Tuw"
> > > > certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The
> > > > certificate/key database is in an old, unsupported format.
> > > >
> > > >
> > > >
> > > > On Wednesday, October 8, 2014 7:55 PM, Mark Kirkwood
> > > > <mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>
> <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>>
> <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>
> <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>>>
> > > <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>
> <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>>
> > <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>
> <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>>>>> wrote:
> > > >
> > > >
> > > > As a workaround check if your rgw host has openssl and certutil
> > > > installed, if so you can copy the relevant unconverted certs
over
> > to it
> > > > and convert 'em there.
> > > >
> > > > On 09/10/14 15:07, lakshmi k s wrote:
> > > > > Tried aptitude as well, but no luck.
> > > > >
> > > > > Ceph users, have you tried to install libnss3-tools or
certutil
> > > tool on
> > > > > debian/ubuntu? If so, how did you go about this problem.
> > > > >
> > > > >
> > > > > On Wednesday, October 8, 2014 7:01 PM, Mark Kirkwood
> > > > > <mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>
> <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>>
> > <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>
> <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>>>
> > <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>
> <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>>
>
> > <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>
> <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>>>>
> > > > <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>
> <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>>
> > <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>
> <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>>>
> >
> > > <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>
> <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>>
> > <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>
> <mailto:mark.kirkwood@xxxxxxxxxxxxxxx
<mailto:mark.kirkwood@xxxxxxxxxxxxxxx>>>>>> wrote:
> > >
> > > > >
> > > > >
> > > > > Ok, so that is the thing to get sorted. I'd suggest
posting the
> > > error(s)
> > > > > you are getting perhaps here (someone else might know), but
> > definitely
> > > > > to one of the Debian specific lists.
> > > > >
> > > > > In the meantime perhaps try installing the packages with
> aptitude
> > > rather
> > > > > than apt-get - if there is some fancy footwork required it is
> > fairly
> > > > > smart about what needs to be done.
> > > > >
> > > > > Cheers
> > > > >
> > > > > Mark
> > > > >
> > > > > On 09/10/14 14:38, lakshmi k s wrote:
> > > > > > Thanks Mark. I have been trying to install this on
controller
> > > > node. But
> > > > > > for some reason, I am unable to install certutil or
> > > libnss3-tools on
> > > > > > debian. I am not sure how to proceed.
> > > > > >
> > > > >
> > > > >
> > > > >
> > > >
> > > >
> > > >
> > >
> > >
> > >
> >
> >
> >
>
>
>
_______________________________________________
ceph-users mailing list
ceph-users@xxxxxxxxxxxxxx
http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com
